JP2004032502A - Encrypted communication apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problem wherein communication with an opposite apparatus will be disabled; if encrypted communication is not established. <P>SOLUTION: An encrypted communication apparatus 10 comprises a memory section 13 for storing encrypting algorithm information; an algorithm selection means 31 for selecting arbitrary encrypting algorithm information from a plurality of pieces of encrypting algorithm information being stored; an encryption process section 14 for encrypting communication data from a communication terminal apparatus 3, based on the selected encrypting algorithm information; and a data transmission section 15 for transmitting the communication data to the opposite-side apparatus by encrypted communication for encrypting the communication data. When destination information from the communication terminal apparatus 3 is detected, arbitrary encrypting algorithm information is selected by the algorithm selection means, the selected encrypting algorithm information is reported to the opposite-side apparatus by non-coding communication by an algorithm transmission means 32. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an encrypted communication device that encrypts call voice and communication data from a communication terminal device, and transmits the encrypted data to an opposite device.
[0002]
[Prior art]
Conventionally, as such an encrypted communication device, the one disclosed in JP-A-2001-36518 is known.
[0003]
This encrypted communication device has a transmission-side encrypted communication device connected to the transmission-side communication terminal device, and a remote-device-side encrypted communication device connected to the remote-device-side communication terminal device. The device and the opposing device-side encrypted communication device are disposed between the originating communication terminal device and the opposing device-side communication terminal device, respectively, and implement encrypted communication between these communication terminal devices.
[0004]
The originating-side encrypted communication device has an encryption processing function for encrypting data from the originating-side communication terminal device and a decryption processing function for decrypting data from the opposing device-side encrypted communication device. The other device-side encrypted communication device also has an encryption processing function for encrypting data from the other device-side communication terminal device and a decryption processing function for decrypting data from the originating-side encrypted communication device. ing.
[0005]
The encryption communication device includes a management table that stores destination information, which is identification information of a user to be used in advance, encryption algorithm information to be used by each user, and an encryption key corresponding to the encryption algorithm information. Upon detecting the destination information, a search unit searches the management table for encryption algorithm information corresponding to the destination information, and searches the management table for an encryption key corresponding to the searched encryption algorithm information. An encryption unit that encrypts or decrypts data based on the algorithm information and the encryption key.
[0006]
According to this conventional encryption communication device, the encryption algorithm information and the encryption key associated with the respective destination information are managed in the transmission-side encryption communication device and the opposite device-side encryption communication device, By using the encryption algorithm information and the encryption key corresponding to the destination information, respectively, the encrypted communication between the transmitting-side encrypted communication device and the opposite-device-side encrypted communication device is established. Data communication can be performed between the terminal device and the communication device on the opposite device side.
[0007]
[Problems to be solved by the invention]
However, according to the above-described conventional encrypted communication device, the management tables of the transmitting-side encrypted communication device and the counterpart device-side encrypted communication device manage the encryption algorithm information, the encryption key, and the like associated with the respective destination information. In addition, by using the encryption algorithm information and the encryption key corresponding to the respective destination information, respectively, the encrypted communication between the transmitting side encrypted communication device and the opposite device side encrypted communication device is established. That is, since the encrypted communication devices recognize the encryption algorithm information to be used based on the contents of the respective management tables, the communication between the encrypted communication devices is established only from the beginning by the encrypted communication. Therefore, for example, when the content of the management table of the transmission-side encrypted communication device is changed, the content of the management table of the opposite device-side encrypted communication device is also changed along with the change of the content. Unless following changes, since it is not possible to recognize the encryption algorithm information to be used between the encryption communication device can not be establishing communication between the encryption communication device.
[0008]
Further, according to the above-described conventional encrypted communication device, in order to establish data communication between the originating communication terminal device and the opposite device communication terminal device, communication between the encrypted communication devices must be established. Moreover, since the communication between the encrypted communication devices is established only by the encrypted communication, for example, when the opposite device is not the encrypted communication device but a terminal connection device, the terminal connection device has an encrypted communication function. Therefore, encrypted communication cannot be established between the transmitting-side encrypted communication device and the terminal connection device, and data communication between the communication terminal devices cannot be established.
[0009]
The present invention has been made in view of the above points, and an object of the present invention is to provide a method for transmitting data to and from an opposing device even if encryption algorithm information is changed or the opposing device does not have an encrypted communication function. An object of the present invention is to provide an encrypted communication device capable of securing communication.
[0010]
[Means for Solving the Problems]
In order to achieve the above object, an encrypted communication device according to the present invention comprises: a communication terminal connecting means for communicatively connecting to a communication terminal device; a counterpart device connecting means for communicatively connecting to a counterpart device; An algorithm selecting means for selecting arbitrary encryption algorithm information from a plurality of pieces of encryption algorithm information stored in the storage means; and the communication terminal device based on the encryption algorithm information selected by the algorithm selecting means. Encryption processing means for encrypting communication data from the communication terminal device, and receiving communication data from the communication terminal device, encrypting the communication data by the encryption processing means, and performing the encrypted communication. An encrypted communication device having data transmission means for transmitting data to the opposite device, wherein when the destination information is detected, the algorithm Select any encryption algorithm information from the storage means at Zum selecting means, and to have an algorithm transmitting means for notifying the opposing device in non-encrypted communication the selected encryption algorithm information.
[0011]
Therefore, according to the encrypted communication device of the present invention, upon detecting the destination information of the opposing device, any encryption algorithm information is selected from the storage means, and the selected encryption algorithm information is transmitted by the non-encrypted communication to the opposing device. In other words, before setting communication with the opposing device to non-encrypted communication before transmitting communication data to the opposing device, the selected encryption algorithm information is transmitted to the opposing device by non-encrypted communication. , The encryption algorithm information in the storage means may be changed, or even if the other device does not have an encrypted communication function, it is possible to perform communication with the other device in unencrypted communication. Further, the other device can sequentially recognize the encryption algorithm information selected by the transmitting-side encrypted communication device.
[0012]
Further, according to the encryption communication device of the present invention, instead of managing the encryption algorithm information for each destination information, an arbitrary encryption algorithm information is selected from a plurality of encryption algorithm information stored in the storage unit. As a result, there is more room for selection of encryption algorithm information, and the encryption algorithm information in the storage means is changed. Even if the management content is not changed on the opposite device side in accordance with the change, the other By using the encryption algorithm information described above, encrypted communication with the opposing device can be established.
[0013]
The encrypted communication device according to the present invention includes: an algorithm receiving unit that receives the encryption algorithm information selected by the opposite device from the opposite device in the non-encrypted communication; and an encryption algorithm that is received by the algorithm receiving unit. An algorithm presence / absence determination means for determining whether or not information is in the storage means; a data reception means for receiving communication data from the opposite device; and the algorithm presence / absence determination means determining that there is encryption algorithm information. Then, the same encryption algorithm information is selected from the storage means by the algorithm selection means, and communication from the opposite device received by the data reception means is performed based on the selected encryption algorithm information. Decoding means for decoding data.
[0014]
Therefore, according to the encrypted communication device of the present invention, when it is determined that the encryption algorithm information received from the opposite device is in the storage unit, the same encryption algorithm information is selected from the storage unit, and this selection is performed. Since the communication data is decrypted based on the encrypted algorithm information, any encryption algorithm information is selected even from the opposite device, and it is determined that the same encryption algorithm information exists on the encrypted communication device. Then, the encrypted communication can be realized based on the encryption algorithm information, and the encrypted communication data can be decrypted from the opposite device side.
[0015]
In the encrypted communication device according to the present invention, when the algorithm transmitting unit determines that there is no encryption algorithm information in the algorithm presence / absence determining unit, the algorithm selecting unit stores any encryption algorithm information from the storage unit. Is selected, and the selected encryption algorithm information is notified to the opposite device by the non-encrypted communication.
[0016]
Therefore, according to the encrypted communication device of the present invention, when it is determined that the encryption algorithm information received from the opposite device is not in the storage unit, the encryption communication device selects arbitrary encryption algorithm information from the storage unit, and selects the selected encryption algorithm information. Since the encryption algorithm information is notified to the opposite device by non-encrypted communication, the encryption algorithm information is notified to each other between the opposite devices, and finally stored in the mutual storage means. The same encryption algorithm information can be selected.
[0017]
The encrypted communication device of the present invention has a priority table storing, for each of the destination information, a priority for selecting the encryption algorithm information by the algorithm selection means, and the algorithm selection means stores the destination information in the Upon detection, encryption algorithm information is selected from the storage unit based on the priority order corresponding to the destination information in the priority order table.
[0018]
Therefore, according to the encrypted communication device of the present invention, the encrypted communication device has a priority order table for storing the priority order for selecting the encryption algorithm information for each destination information. Since the encryption algorithm information is selected based on the priority order, the selection operation relating to the encryption algorithm information for each destination information can be improved.
[0019]
The encryption communication device of the present invention, after notifying the opposite device of the encryption algorithm information by the algorithm transmitting means, determines within a predetermined time whether or not the encryption algorithm information has been received from the opposite device. A receiving terminal for determining whether the encryption algorithm information has not been received by the receiving determining unit; Communication data from the device is now transmitted.
[0020]
Therefore, according to the encrypted communication device of the present invention, after notifying the opposite device of the encryption algorithm information, it is determined that the encryption algorithm information has not been received from the opposite device within a predetermined time. In addition, since the communication data is transmitted to the other device by the non-encrypted communication, even if the other device does not have the encryption communication function, the data communication with the other device can be realized by the non-encrypted communication. Can be.
[0021]
The encryption communication device of the present invention, after notifying the opposite device of the encryption algorithm information by the algorithm transmitting means, determines within a predetermined time whether or not the encryption algorithm information has been received from the opposite device. The data transmission unit includes a determination unit that determines that the encryption algorithm information has been received by the reception determination unit. While transmitting the communication data, the data receiving unit, when it is determined by the reception determining unit that the encryption algorithm information is received, the communication terminal device to the communication terminal device in the non-encrypted communication from the opposite device Communication data is now transmitted.
[0022]
Therefore, according to the encrypted communication device of the present invention, after notifying the opposite device of the encryption algorithm information, it is determined that the encryption algorithm information has not been received from the opposite device within a predetermined time. And perform data communication with the opposing device in unencrypted communication, so that even if the opposing device does not have an encryption communication function, data communication with the opposing device can be realized in unencrypted communication. be able to.
[0023]
The encrypted communication device according to the present invention includes a secret key storage unit that stores a secret key common to the opposite device, a public key generation unit that randomly generates a public key, and a public key generated by the public key generation unit. To the opposing device, and a public key transmitting means for receiving the opposing device side public key from the opposing device, and a common key for generating a common key based on the opposing device public key received by the public key transmitting means. A key generation unit, wherein the encrypted communication includes a first encrypted communication based on the encryption algorithm information and the secret key, and a second encrypted communication based on the common key, and the public key transmission Means for encrypting the public key generated by the public key generation means by the encryption processing means on the basis of the encryption algorithm information and the secret key, in the first encrypted communication, Key to the opposite device While transmitting, based on the encryption algorithm information and the secret key, the opposite device-side public key received from the opposite device is decrypted by the decryption processing unit, and the data transmission unit is configured by the common key. Based on the common key generated by the generation unit, the communication data from the communication terminal device is encrypted by the encryption processing unit in the second encrypted communication, and the encrypted communication data is transmitted to the opposite device. I did it.
[0024]
Therefore, according to the encrypted communication device of the present invention, the public key is encrypted by the first encrypted communication based on the encryption algorithm information and the secret key, and the encrypted public key is transmitted to the opposite device. The opposite device side public key from the opposite device is decrypted by the encrypted communication, a common key is generated based on the opposite device side public key, and the communication data is encrypted by the second encrypted communication based on the common key. Since the encrypted communication data is transmitted to the opposing device, the encrypted communication can be realized in two stages of the first encrypted communication and the second encrypted communication.
[0025]
The encrypted communication device according to the present invention includes a secret key storage unit that stores a secret key common to the opposite device, a public key generation unit that randomly generates a public key, and a public key generated by the public key generation unit. To the opposing device, and a public key transmitting means for receiving the opposing device side public key from the opposing device, and a common key for generating a common key based on the opposing device public key received by the public key transmitting means. A key generation unit, wherein the encrypted communication includes a first encrypted communication based on the encryption algorithm information and the secret key, and a second encrypted communication based on the common key, and the public key transmission Means for encrypting the public key generated by the public key generation means by the encryption processing means on the basis of the encryption algorithm information and the secret key, in the first encrypted communication, Key to the opposite device While transmitting, based on the encryption algorithm information and the secret key, the opposite device-side public key received from the opposite device is decrypted by the decryption processing unit, and the data transmission unit is configured by the common key. Based on the common key generated by the generation unit, the communication data from the communication terminal device is encrypted by the encryption processing unit in the second encrypted communication, and the encrypted communication data is transmitted to the opposite device. And the data receiving unit is configured to decrypt the communication data from the opposite device by the decryption processing unit based on the common key generated by the common key generation unit. The decrypted communication data is transmitted to the communication terminal device.
[0026]
Therefore, according to the encrypted communication device of the present invention, the public key is encrypted by the first encrypted communication based on the encryption algorithm information and the secret key, and the encrypted public key is transmitted to the opposite device. The opposite device side public key from the opposite device is decrypted by the encrypted communication, a common key is generated based on the opposite device side public key, and the communication data is encrypted by the second encrypted communication based on the common key. Since the encrypted communication data is transmitted to the opposing device and the communication data from the opposing device is decrypted by the second encrypted communication, a two-stage configuration of the first encrypted communication and the second encrypted communication is provided. Thus, encrypted communication can be realized.
[0027]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, an encryption communication system showing an embodiment in an encryption communication device of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a schematic configuration of the entire encrypted communication system according to the present embodiment.
[0028]
An encryption communication system 1 shown in FIG. 1 is an encryption system that controls an integrated digital communication line 2, for example, four communication terminal devices 3, and an interface that connects and connects the communication terminal devices 3 and the integrated digital communication line 2. The communication device 10 or the terminal connection device 4 is provided.
[0029]
It is assumed that the encrypted communication device 10 has the encrypted communication function, whereas the terminal connection device 4 does not have the encrypted communication function.
[0030]
For convenience of explanation, the encrypted communication device 10 is assumed to have an originating encrypted communication device of 10A, the opposite device side of an encrypted communication device is assumed to be 10B, and the communication terminal device 3 is assumed to have an originating communication device for convenience of explanation. The terminal device is 3A, and the communication terminal device on the opposite device side is 3B.
[0031]
FIG. 2 is a block diagram showing a schematic configuration inside the encrypted communication device 10 according to the present embodiment.
[0032]
An encrypted communication device 10 shown in FIG. 2 includes a communication terminal device connection unit 11 that manages an interface with the communication terminal device 3, an integrated digital communication line connection unit 12 that manages an interface with the integrated digital communication line 2, and a plurality of encryption devices. Memory unit 13 that stores various information such as encryption algorithm information, an encryption processing unit 14 that encrypts communication data from the communication terminal device 3, and a communication data that is encrypted by the encryption processing unit 14. A data transmitting unit 15 for transmitting data to the opposing device through the integrated digital communication line connecting unit 12; a data receiving unit 16 for receiving communication data from the opposing device through the integrated digital communication line connecting unit 12; A decryption processing unit 17 for decryption, and encryption algorithm information set by the encryption processing unit 14 and the decryption processing unit 17 are set. An encryption algorithm setting section 18, and a control unit 19 which controls the entire encrypted communication system 10.
[0033]
The encryption processing unit 14 performs an encryption process or a non-encryption process based on the encryption algorithm information set by the encryption algorithm setting unit 18 and executes an encryption process based on a common key described later. Function.
[0034]
Similarly, the decryption processing unit 17 performs a decryption process or a non-decryption process based on the encryption algorithm information set by the encryption algorithm setting unit 18 and a decryption process based on a common key described later. And a function of executing a conversion process.
[0035]
Note that the encryption algorithm information set by the encryption algorithm setting unit 18 includes encryption algorithm information for executing non-encryption communication of non-encryption processing and non-decryption processing. .
[0036]
Further, the encrypted communication device 10 includes a secret key storage unit 20 for storing a secret key common to the opposite device, a public key generation unit 21 for randomly generating a public key, and a common key based on the opposite device side public key. And a common key generation unit 22 that generates
[0037]
The public key generated by the public key generation unit 21 of the transmitting side encrypted communication device 10A is transmitted to the opposite device side encrypted communication device 10B through the data transmission unit 15, and the public key generated by the opposite device side encrypted communication device 10B. The public key generated by the public key generation unit 21 is transmitted to the originating encrypted communication device 10A through the data transmission unit 15. That is, the common key generation unit 22 of the encrypted communication device 10 generates a common key based on the public key exchanged with the opposite device.
[0038]
The common key is an encryption key used for performing data communication between the communication terminal devices 3 by encrypted communication.
[0039]
Further, the encryption communication device 10 includes an encryption algorithm information transmission unit 23 that transmits the encryption algorithm information selected by the algorithm selection unit 31 described later in the control unit 19 to the opposite device by non-encryption communication, And an encryption algorithm information receiving unit 24 for receiving the encryption algorithm information selected by the algorithm selection means 31 on the side in unencrypted communication.
[0040]
FIG. 3 is a block diagram showing a schematic configuration inside a control unit 19 which is a main part of the encrypted communication device 10 according to the present embodiment.
[0041]
When detecting the destination information from the communication terminal device 3 through the communication terminal device connection unit 11, the control unit 19 selects an encryption algorithm information corresponding to the destination information from the memory unit 13; An algorithm transmitting means 32 for transmitting the encryption algorithm information selected by the selecting means 31 to the opposing device through the encryption algorithm information transmitting section 23 by non-encrypted communication, and an encrypting algorithm information receiving section 24 from the opposing device. An algorithm receiving unit 33 for receiving the selected encryption algorithm information; an algorithm presence / absence determining unit 34 for determining whether or not the encryption algorithm information received by the algorithm receiving unit 33 is in the memory unit 13; Means 32 to transmit the encryption algorithm information to the opposite device. After, within a predetermined time, and a reception determination unit 35 determines whether it has received the encryption algorithm information from the opposite device.
[0042]
When the algorithm presence / absence determining means 34 determines that the encryption algorithm information is present in the memory section 13, the algorithm selection section 31 selects the same encryption algorithm information from the memory section 13 and selects the selected encryption algorithm information. The algorithm information is set in the encryption processing unit 14 and the decryption processing unit 17 through the encryption algorithm setting unit 18.
[0043]
Further, if the reception determining means 35 does not receive the encryption algorithm information from the opposing device within a predetermined time, the algorithm selecting means 31 performs the non-encryption processing so as to execute the data communication with the opposing apparatus by the unencrypted communication. The encryption algorithm information related to the communication is selected, and the selected encryption algorithm information is set in the encryption processing unit 14 and the decryption processing unit 17 through the encryption algorithm setting unit 18.
[0044]
The opposite device described in the claims is the terminal connection device 4 or the encrypted communication device 10B on the opposite device side, the communication terminal connection means is the communication terminal device connection unit 11, the opposite device connection means is the integrated digital communication line connection unit 12, and the storage unit. The means is a memory unit 13, the encryption unit is an encryption unit 14, the data transmission unit is a data transmission unit 15, the data reception unit is a data reception unit 16, the decryption unit is a decryption unit 17, and a secret key storage unit. Represents a secret key storage unit 20, a public key generation unit corresponds to a public key generation unit 21, a common key generation unit corresponds to a common key generation unit 22, and a public key transmission unit corresponds to a data transmission 15 and a data reception unit 16.
[0045]
Next, the operation of the encrypted communication system 1 according to the present embodiment will be described. FIG. 4 is a sequence briefly showing a data communication setting operation between the communication terminal devices 3A and 3B between the encrypted communication devices 10A and 10B.
[0046]
In FIG. 4, the calling side encrypted communication device 10A detects the calling from the calling side communication terminal device 3A (step S11), and further detects the destination information indicating the communication partner from the calling side communication terminal device 3A (step S12). ), And requests a call setting to the opposite device side encrypted communication device 10B through the integrated digital communication line 2 (step S13).
[0047]
Upon detecting the call setting request, the other device-side encrypted communication device 10B notifies the calling-side encrypted communication device 10A of the call setting acceptance for accepting the call setting request (step S14), and the call is encrypted by the calling-side encrypted communication device 10A. The communication device 10A is notified (step S15).
[0048]
Further, the opposite device-side encrypted communication device 10B notifies the opposite device-side communication terminal device 3B of the incoming call (step S16).
[0049]
When detecting the reception of the incoming call from the communication terminal device 3B on the opposite device side (step S17), the opposite device-side encrypted communication device 10B notifies the originating encrypted communication device 10A of a response (step S18).
[0050]
Further, upon detecting a response from the opposite-side encrypted communication device 10B, the originating-side encrypted communication device 10A notifies the opposite-side encrypted communication device 10B of a response confirmation for confirming the response (step S19). This means that the non-encrypted communication has been established with the opposing device-side encrypted communication device 10B (step S20).
[0051]
Further, when the non-encrypted communication is established, the transmitting-side encrypted communication device 10A selects the encryption algorithm information corresponding to the destination information in step S12 from the memory unit 13, and stores the selected encryption algorithm information in the designated algorithm. Is transmitted to the other-party-side encrypted communication device 10B in unencrypted communication (step S21).
[0052]
Upon receiving the designated algorithm, the other-party-side encrypted communication device 10B determines whether or not the same encryption algorithm information as the designated algorithm exists in the memory unit 13. If determined, the encryption algorithm information is selected, and the selected encryption algorithm information is transmitted as a response algorithm to the originating encrypted communication device 10A (step S22).
[0053]
Upon receiving the response algorithm from the opposite-side encrypted communication device 10B, the originating-side encrypted communication device 10A performs an algorithm response confirmation for confirming the response using the selected encryption algorithm information as common encryption algorithm information. To the communication device 10B (step S23).
[0054]
At this time, the same encryption algorithm information is selected by the algorithm selecting means 31 of the originating-side encrypted communication device 10A and the opposite-side encrypted communication device 10B (steps S24 and S25). Accordingly, the first encrypted communication based on the same encryption algorithm information is established between the originating encrypted communication device 10A and the opposite device encrypted communication device 10B (step S26).
[0055]
The first encrypted communication is used for exchanging a public key between the transmitting-side encrypted communication device 10A and the opposite device-side encrypted communication device 10B.
[0056]
When the first encrypted communication is established, the public key generation unit 21 of the originating-side encrypted communication device 10A generates a public key based on the encryption algorithm information and the secret key. The encrypted communication is transmitted to the opposing device-side encrypted communication device 10B (step S27).
[0057]
Similarly, when the first encrypted communication is established, the public key generation unit 21 of the opposite device side encrypted communication device 10B generates a public key based on the encryption algorithm information and the secret key, and generates the public key. The first encrypted communication is transmitted to the originating encrypted communication device 10A (step S28). That is, the public key is exchanged between the transmitting side encrypted communication device 10A and the opposite device side encrypted communication device 10B.
[0058]
The common key generation unit 22 of the encrypted communication device 10A generates a common key based on the public key received from the opposite device-side encrypted communication device 10B (step S29), and enables communication with the communication terminal device (step S29). Step S30).
[0059]
Similarly, the common key generation unit 22 of the opposite-side encrypted communication device 10B generates a common key based on the public key received from the transmission-side encrypted communication device 10A (step S31), and the opposite-side communication terminal device 3B Is enabled (step S32).
[0060]
Then, the originating-side encrypted communication device 10A and the opposing device-side encrypted communication device 10B set the respective common keys in the encryption processing unit 14 and the decryption processing unit 17 through the encryption algorithm setting unit 18, and thereby, This means that the second encrypted communication has been established based on the common key (step S33).
[0061]
The second encrypted communication is used for data communication between the originating communication terminal device 3A and the opposing device communication terminal device 3B.
[0062]
Therefore, when the second encrypted communication is established, the originating encrypted communication device 10A and the opposite device encrypted communication device 10B perform the originating communication terminal device 3A and the opposed device communication terminal device in the second encrypted communication. Data communication between 3B is performed. Note that the encryption key sharing scheme of the second encrypted communication employs a general scheme such as a Diffe-Helman scheme or an RSA scheme.
[0063]
It should be noted here that the same encryption algorithm information needs to be selected in order to establish the first encrypted communication between the transmitting side encrypted communication device 10A and the opposite side encrypted communication device 10B. However, when selecting the same encryption algorithm information, negotiation between the transmitting side encrypted communication device 10A and the opposite device side encrypted communication device 10B is performed by non-encrypted communication from step S20 to step S25. That's what it means.
[0064]
FIG. 5 is a sequence briefly showing the data communication setting operation between the communication terminal devices 3A and 3B between the originating encrypted communication device 10A and the terminal connection device 4.
[0065]
In FIG. 5, the originating-side encrypted communication device 10 </ b> A performs negotiation for communication preparation from step S <b> 11 to step S <b> 19 with the terminal connection device 4.
[0066]
When detecting the response confirmation from the transmitting side encrypted communication device 10A in step S19, the terminal connection device 4 notifies the opposite device side communication terminal device 3B that communication is possible (step S41).
[0067]
When the transmitting side encrypted communication device 10A notifies the terminal connection device 4 of the response confirmation, the non-encrypted communication with the terminal connection device 4 has been established (step S42). At the time of step S42, the transmitting-side encrypted communication device 10A does not recognize whether or not the opposing device is the terminal connection device 4.
[0068]
When non-encrypted communication is established, the algorithm selecting means 31 of the originating-side encrypted communication device 10A selects arbitrary encryption algorithm information from the memory unit 13 and uses the selected encryption algorithm information as a designated algorithm. The encrypted communication is transmitted to the terminal connection device 4 (step S43).
[0069]
Further, the reception determining means 35 of the originating-side encrypted communication device 10A starts a timer for a predetermined time after transmitting the designated algorithm to the terminal connection device 4 in step S43, and within a predetermined time, the other device side (terminal connection device). If it is determined that the timeout has occurred without receiving the response algorithm or the designated algorithm from 4) (step S44), the algorithm selecting means 31 selects encryption algorithm information corresponding to non-encrypted communication (step S45). ).
[0070]
Upon selecting the encryption algorithm information corresponding to the non-encrypted communication, the calling-side encrypted communication device 10A notifies the calling-side communication terminal device 3A that communication is possible (step S46). Therefore, the originating communication terminal device 3A and the opposing device communication terminal device 3B have established data communication of non-encrypted communication via the originating encrypted communication device 10A and the terminal connection device 4 (step S47). ).
[0071]
As described above, according to the encrypted communication system 1 shown in FIG. 5, even if the opposing device is the terminal connection device 4 not having the encrypted communication function, the originating communication terminal device 3A and the opposing device Rather than preventing data communication between the communication terminal devices 3B, data communication between the communication terminal device 3A on the transmitting side and the communication terminal device 3B on the opposite device side can be performed by non-encrypted communication.
[0072]
Next, the data communication setting operation between the communication terminal devices 3A and 3B shown in FIGS. 4 and 5 will be described in detail from the viewpoint of the encrypted communication device 10A. FIG. 6 is a flowchart showing the processing operation of the control unit 19 inside the encrypted communication device 10A related to the data communication setting process between communication terminal devices.
[0073]
The data communication setting process between communication terminal devices shown in FIG. 6 is a process for establishing data communication between the communication terminal device 3A on the calling side and the communication terminal device 3B on the opposite device side.
[0074]
In FIG. 6, the control unit 19 of the transmitting-side encrypted communication device 10A determines whether or not destination information has been detected from the transmitting-side communication terminal device 3A (step S51).
[0075]
If the algorithm selection means 31 of the control unit 19 detects the destination information from the communication terminal device 3A, the algorithm selection unit 31 communicates with the opposite device (the opposite device-side encrypted communication device 3B or the terminal connection device 4) corresponding to the destination information. Unencrypted communication is established between them (step S52).
[0076]
Upon detecting the destination information from the originating communication terminal device 3A, the algorithm selecting means 31 selects arbitrary encryption algorithm information from the memory unit 13 (step S53).
[0077]
The algorithm transmitting unit 32 of the control unit 19 transmits the arbitrary encryption algorithm information selected by the algorithm selecting unit 31 to the opposing device (the opposing device-side encrypted communication device 3B or the terminal connection device 4) as a designated algorithm (step). S54).
[0078]
After transmitting the designated algorithm to the opposing device in step S54, the reception determining means 35 of the control unit 19 starts a timer therein for a predetermined time (step S55), and determines whether or not the predetermined time timer has expired. A determination is made (step S56).
[0079]
Further, if the timer has expired for a predetermined time in the reception determining means 35, that is, after transmitting the designated algorithm to the opposing device, the algorithm selecting unit 31 executes the response algorithm or the designated algorithm from the opposing device within the predetermined time. If it is not received, the opposite device does not have an encrypted communication function, for example, it is determined that the terminal connection device 4 is used, and the data communication between the originating communication terminal device 3A and the opposite device communication terminal device 3B is unencrypted. By setting the communication (step S57), data communication between the originating communication terminal device 3A and the opposing device communication terminal device 3B is established by non-encrypted communication as shown in step S47 of FIG. To end.
[0080]
If the timer has not expired for the predetermined time in step S56, the reception determining means 35 determines whether a response algorithm has been received from the opposite device (step S58).
[0081]
If the control unit 19 receives the response algorithm from the opposing device in step S58, the control unit 19 transmits a response confirmation to the opposing device by non-encrypted communication (step S59).
[0082]
Further, after transmitting the response confirmation to the opposing device in step S59, the algorithm selecting means 31 selects encryption algorithm information relating to the response algorithm from the memory unit 13 (step S60), and selects the selected encryption algorithm. By setting the data communication between the transmitting-side encrypted communication device 10A and the opposing device-side encrypted communication device 10B to the encrypted communication in the information-based encrypted communication (step S61), as shown in step S26 in FIG. The data communication between the encrypted communication devices 10A and 10B is established by the first encrypted communication.
[0083]
Further, when the data communication between the encrypted communication devices 10A and 10B is established in step S61, the control unit 19 exchanges the public key between the encrypted communication devices 10A and 10B in the encrypted communication and performs the common communication. Through the key generation unit 22, a common key is generated based on the public key received from the encrypted communication device 10B on the opposite device side (step S62).
[0084]
Further, the control unit 19 sets the data communication between the communication terminal device 3A on the calling side and the communication terminal device 3B on the opposite device side to encrypted communication based on the common key generated in step S62 (step S63). As shown in step S33 of FIG. 5, the data communication between the communication terminal devices 3A and 3B is established by the second encrypted communication, and this processing operation ends.
[0085]
If the response algorithm has not been received from the opposite device in step S58, the reception determination unit 35 determines whether or not the designated algorithm has been received from this opposite device (step S64).
[0086]
Further, if the designated algorithm is received from the opposing device in step S64, the algorithm presence / absence determining means 34 of the control unit 19 determines whether the same encryption algorithm information as the designated algorithm exists in the memory unit 13. A determination is made (step S65).
[0087]
If it is determined in step S63 that the same encryption algorithm information as the specified algorithm is present in the memory unit 13, the control unit 19 transmits a response algorithm corresponding to the specified algorithm to the opposing device (step S66).
[0088]
Further, after transmitting the response algorithm in step S66, the control unit 19 determines whether or not a response confirmation has been received from the opposite device (step S67).
[0089]
Upon receiving the response confirmation from the opposing device, the control unit 19 proceeds to step S60 to select encryption algorithm information corresponding to the response algorithm.
[0090]
If it is determined in step S64 that the designated algorithm has not been received from the opposite device, the process proceeds to step S56 to determine whether the timer started in step S55 has expired.
[0091]
If the same encryption algorithm information as the designated algorithm is not found in the memory unit 13 in step S65, another encryption algorithm information is selected from the memory unit 13 (step S68), and the selected encryption algorithm information is selected. Is transmitted to the opposing device as the designated algorithm (step S69), and the process proceeds to step S56.
[0092]
As described above, according to the data communication setting process between the communication terminal devices shown in FIG. 6, before the data communication between the communication terminal device 3A on the calling side and the communication terminal device 3B on the opposite device side is established, the encrypted communication device 10A on the calling side is established. The communication with the remote device (the encrypted communication device 3B or the terminal connection device 4) is first set to the non-encrypted communication. Even if it is not recognized in advance, the encryption communication information common to the opposing device is selected from the plurality of pieces of encryption algorithm information in the memory unit 13, and the encrypted communication device performs the encryption communication based on the common encryption algorithm information. After establishing data communication between 10A and 10B, a public key is generated by exchanging a public key in the encrypted communication, and a communication terminal device is generated in the encrypted communication based on the common key. It can be established A, the data communication between 3B.
[0093]
Further, even if the opposite device is the terminal connection device 4, data communication between the communication terminal devices 3A and 3B can be performed by establishing data communication between the communication terminal devices 3A and 3B by non-encrypted communication. .
[0094]
Similarly, even when the opposite device cannot select common encryption algorithm information in the encrypted communication device 10B, the data communication between the communication terminal devices 3A and 3B is established by non-encrypted communication. And data communication between the communication terminal devices 3A and 3B.
[0095]
According to the present embodiment, when the originating-side encrypted communication device 10A detects the destination information of the opposite device (the opposite-device-side encrypted communication device 10B or the terminal connection device 4), any encryption algorithm information is read from the memory unit 13. Is selected, and the selected encryption algorithm information is notified to the opposing device by unencrypted communication. That is, the communication with the opposing device before the data communication between the communication terminal devices 3A and 3B is established is unencrypted. After setting to encrypted communication, the selected encryption algorithm information is notified to the other device by non-encryption communication, so that the encryption algorithm information in the memory unit 13 changes, or the other device performs encrypted communication. Even without the function, communication with the opposing device can be performed by non-encrypted communication.
[0096]
According to the present embodiment, the originating-side encrypted communication device 10A does not manage encryption algorithm information for each piece of destination information, but uses an arbitrary encryption algorithm based on a plurality of pieces of encryption algorithm information stored in the memory unit 13. Since the information is selected, there is more room for selection of the encryption algorithm information, and further, the encryption algorithm information in the memory unit 13 is changed. In accordance with the change, the management content is changed on the opposite device side. Even if this is not the case, if other encryption algorithm information is used, encrypted communication with the opposite device can be established.
[0097]
According to the present embodiment, originating-side encrypted communication device 10A sets communication with opposing device-side encrypted communication device 10B to non-encrypted communication, and in this unencrypted communication, originating-side encrypted communication device 10A Since the selected encryption algorithm information is notified to the opposite-side encrypted communication device 10B, the opposite device can sequentially recognize the encryption algorithm information selected by the originating-side encrypted communication device 10A.
[0098]
According to the present embodiment, when it is determined that the encryption algorithm information received from the opposite device is in the memory unit 13, the same encryption algorithm information is selected from the memory unit 13 and the selected encryption algorithm information is selected. Since the communication data is decrypted based on the algorithm information, arbitrary encryption algorithm information is selected even from the opposite device side, and it is determined that the same encryption algorithm information is present in the transmission-side encrypted communication device 10A. Then, the encrypted communication can be realized based on the encryption algorithm information, and the encrypted communication data can be decrypted from the opposite device side.
[0099]
According to the present embodiment, when it is determined that the encryption algorithm information received from the opposing device is not in memory unit 13, arbitrary encryption algorithm information is selected from memory unit 13 and the selected encryption algorithm information is selected. Since the information is notified to the opposing device by non-encrypted communication, the encryption communication device 10A and the opposing device notify each other of the encryption algorithm information, so that the mutual memory units are finally communicated. 13, the same encryption algorithm information stored in the memory 13 can be selected.
[0100]
According to the present embodiment, if it is determined that encryption algorithm information has not been received from the opposite device within a predetermined time after notifying the opposite device of the encryption algorithm information, Since data communication with the opposing device is performed by communication, even if the opposing device does not have an encryption communication function, data communication with the opposing device can be realized by non-encrypted communication.
[0101]
According to the present embodiment, the public key is encrypted in the first encrypted communication based on the encryption algorithm information and the secret key, and the encrypted public key is transmitted to the opposing device, and the encrypted key is transmitted in the first encrypted communication. The device decrypts the public key on the opposite device side from the device, generates a common key based on the public key on the opposite device side, encrypts communication data in a second encrypted communication based on the common key, and Is transmitted to the opposing device, and the communication data from the opposing device is decrypted by the second encrypted communication, so that the encrypted communication is performed in two stages of the first encrypted communication and the second encrypted communication. Can be realized.
[0102]
In the above embodiment, the encrypted communication device in which the encrypted communication device 10 includes the encryption processing unit 14 and the decryption processing unit 17 as shown in FIG. 2 has been described as an example. Needless to say, the same effect can be obtained even if there is an encryption communication device that does not include the encryption processing unit 17 and only has the encryption communication function of the encryption processing unit 14.
[0103]
In the above embodiment, the algorithm selecting means 31 selects any encryption algorithm information from the memory unit 13. However, for example, a priority is assigned to each destination information from the originating communication terminal device 3A. Then, a plurality of pieces of encryption algorithm information may be stored, and the encryption algorithm information may be selected based on the priority of each piece of destination information. FIG. 7 is an explanatory diagram showing the contents of the memory of the memory unit 13 that stores the encryption algorithm information in which the priority is assigned to each piece of the destination information.
[0104]
In FIG. 7, the memory unit 13 stores a plurality of encryption algorithm information with priorities assigned to the respective pieces of destination information. For example, the destination information 1 has the first place in the encryption algorithm information A and the second place has the second place. The third place of the encryption algorithm information B is unencrypted.
[0105]
For example, upon detecting the destination information 1 from the communication terminal device 3, the control unit 19 of the encrypted communication device 10 selects the first-ranked encryption algorithm information A corresponding to the destination information 1, and A is transmitted to the opposing device, and if the encryption algorithm information A indicating the response cannot be received from the opposing device, the second-ranked encryption algorithm information B is selected, and the encryption algorithm information B is transmitted to the opposing device. To be transmitted.
[0106]
According to such an encrypted communication device 10, a priority table storing the priority for selecting the encryption algorithm information is stored in the memory unit 13 for each destination information, and when this destination information is detected, Since the encryption algorithm information is selected based on the priority order corresponding to the destination information, the selection operation relating to the encryption algorithm information for each destination information can be improved.
[0107]
【The invention's effect】
According to the encrypted communication device of the present invention configured as described above, upon detecting the destination information of the opposing device, any encryption algorithm information is selected from the storage unit, and the selected encryption algorithm information is unencrypted. Before the communication data is transmitted to the opposing device, the communication with the opposing device is set to the non-encryption communication, and the selected encryption algorithm information is set to the non-encryption communication. Notifying the other device by encrypted communication, the encryption algorithm information in the storage means may change, or even if the other device does not have an encrypted communication function, Communication can be performed, and the other device can sequentially recognize the encryption algorithm information selected by the transmitting-side encrypted communication device.
[0108]
According to the encryption communication device of the present invention, instead of managing the encryption algorithm information for each destination information, an arbitrary encryption algorithm information is selected from a plurality of encryption algorithm information stored in the storage unit. As a result, there is more room for selection of encryption algorithm information, and furthermore, the encryption algorithm information in the storage means is changed. Using the encryption algorithm information, it is possible to establish encrypted communication with the opposing device.
[0109]
According to the encrypted communication device of the present invention, when it is determined that the encryption algorithm information received from the opposite device is in the storage unit, the same encryption algorithm information is selected from the storage unit, and the selected encryption algorithm is selected. Since the communication data is decrypted based on the encryption algorithm information, any encryption algorithm information is selected even from the opposite device side, and it is determined that the same encryption algorithm information exists on the encryption communication device side. Then, the encrypted communication can be realized based on the encryption algorithm information, and the encrypted communication data can be decrypted from the opposite device side.
[0110]
According to the encrypted communication device of the present invention, when it is determined that the encryption algorithm information received from the opposite device is not in the storage means, any encryption algorithm information is selected from the storage means, and the selected encryption algorithm information is selected. Since the algorithm information is notified to the opposite device by non-encrypted communication, the encryption algorithm information is notified to each other with the opposite device, and finally, the same Encryption algorithm information can be selected.
[0111]
According to the encryption communication device of the present invention, the communication apparatus has a priority table storing priority for selecting encryption algorithm information for each destination information, and when the destination information is detected, the priority corresponding to the destination information , The encryption algorithm information is selected, so that the selection operation relating to the encryption algorithm information for each destination information can be improved.
[0112]
According to the encrypted communication device of the present invention, after notifying the opposite device of the encryption algorithm information, within a predetermined time, if it is determined that the encryption algorithm information has not been received from this opposite device, Since the communication data is transmitted to the opposing device by the non-encrypted communication, even if the opposing device does not have the encryption communication function, the data communication with the opposing device can be realized by the unencrypted communication. .
[0113]
According to the encrypted communication device of the present invention, after notifying the opposite device of the encryption algorithm information, within a predetermined time, if it is determined that the encryption algorithm information has not been received from this opposite device, Since data communication with the opposing device is executed by non-encrypted communication, even if the opposing device does not have an encryption communication function, data communication with the opposing device can be realized by unencrypted communication. it can.
[0114]
According to the encrypted communication device of the present invention, the public key is encrypted by the first encrypted communication based on the encryption algorithm information and the secret key, and the encrypted public key is transmitted to the opposite device, and the first encrypted communication is performed. The communication device decrypts the public key of the remote device from the remote device by communication, generates a common key based on the public key of the remote device, encrypts communication data by a second encrypted communication based on the common key, and encrypts the communication data. Since the communication data obtained is transmitted to the opposing device, the encrypted communication can be realized in two stages of the first encrypted communication and the second encrypted communication.
[0115]
According to the encrypted communication device of the present invention, the public key is encrypted by the first encrypted communication based on the encryption algorithm information and the secret key, and the encrypted public key is transmitted to the opposite device, and the first encrypted communication is performed. The communication device decrypts the public key of the remote device from the remote device by communication, generates a common key based on the public key of the remote device, encrypts communication data by a second encrypted communication based on the common key, and encrypts the communication data. The encrypted communication data is transmitted to the opposing device, and the communication data from the opposing device is decrypted in the second encrypted communication. Therefore, the encrypted data is encrypted in two stages of the first encrypted communication and the second encrypted communication. Communication can be realized.
[Brief description of the drawings]
FIG. 1 is a block diagram showing an overall configuration of an encrypted communication system showing an embodiment in an encrypted communication device of the present invention.
FIG. 2 is a block diagram showing a schematic configuration inside an encryption communication device inside the encryption communication system showing the present embodiment.
FIG. 3 is a block diagram showing a schematic configuration inside a control unit which is a main part inside the encrypted communication device according to the present embodiment.
FIG. 4 is a sequence simply showing a data communication setting operation between communication terminal devices between encrypted communication devices of the encrypted communication system according to the present embodiment.
FIG. 5 is a sequence briefly showing a data communication setting operation between communication terminal devices between an encryption communication device and a terminal connection device of the encryption communication system according to the present embodiment.
FIG. 6 is a flowchart showing a processing operation of a control unit in the encryption communication device related to a data communication setting process between communication terminal devices according to the present embodiment.
FIG. 7 is an explanatory diagram showing memory contents of a memory unit inside an encrypted communication device according to another embodiment.
[Explanation of symbols]
3 Communication terminal device
4 Terminal connection device (opposite device)
10 (10A) encrypted communication device
10B Encrypted communication device on opposing device (opposite device)
11 Communication terminal device connection unit (communication terminal connection means)
12 Integrated digital communication line connection (opposite device connection means)
13 Memory part (storage means)
14. Encryption processing unit (encryption processing means)
15 Data transmission unit (data transmission means, public key transmission means)
16 data receiving unit (data receiving means, public key transmission means)
17 Decoding processing unit (decoding processing means)
19 Control part
20 Secret key storage (secret key storage means)
21 Public key generation unit (public key generation means)
22 Common key generation unit (common key generation means)
31 Algorithm selection means
32 Algorithm transmission means
33 Algorithm receiving means
34 Algorithm existence judgment means
35 Reception judgment means

Claims (8)

Communication terminal connection means for communication connection with the communication terminal apparatus, opposite device connection means for communication connection with the opposite device, storage means for storing encryption algorithm information, and a plurality of encryption algorithm information stored in the storage means. Algorithm selecting means for selecting arbitrary encryption algorithm information; encryption processing means for encrypting communication data from the communication terminal device based on the encryption algorithm information selected by the algorithm selecting means; Upon receiving communication data from the terminal device, the communication device encrypts the communication data with the encryption processing unit, and includes an encryption communication unit that transmits the encrypted communication data to the opposite device. A communication device,
When the destination information is detected, the algorithm selecting means selects any encryption algorithm information from the storage means, and has an algorithm transmission means for notifying the selected encryption algorithm information to the opposite device by non-encrypted communication. An encrypted communication device, characterized in that: An algorithm receiving unit that receives the encryption algorithm information selected by the opposite device by the non-encrypted communication from the opposite device,
An algorithm presence / absence determining means for determining whether or not the encryption algorithm information received by the algorithm receiving means is in the storage means;
Data receiving means for receiving communication data from the opposite device;
When it is determined by the algorithm presence / absence determining means that there is encryption algorithm information, the same encryption algorithm information is selected from the storage means by the algorithm selecting means, and based on the selected encryption algorithm information. 2. The encrypted communication apparatus according to claim 1, further comprising: decryption processing means for decrypting communication data from said opposite apparatus received by said data receiving means. The algorithm transmitting means,
When the algorithm presence / absence determination means determines that there is no encryption algorithm information, the algorithm selection means selects any encryption algorithm information from the storage means, and then selects the selected encryption algorithm information with the non-encryption information. 3. The encrypted communication device according to claim 2, wherein the communication device notifies the other device by encrypted communication. For each of the destination information, there is provided a priority order table storing a priority order for selecting encryption algorithm information in the algorithm selection means,
The algorithm selection means,
4. The method according to claim 1, further comprising, upon detecting the destination information, selecting encryption algorithm information from the storage unit based on a priority order corresponding to the destination information in the priority order table. Encrypted communication device. After notifying the opposite device of the encryption algorithm information by the algorithm transmission unit, within a predetermined time, has a reception determination unit that determines whether or not the encryption algorithm information has been received from the opposite device,
The data transmission means,
The communication data from the communication terminal device is transmitted to the opposite device by the non-encrypted communication when the reception determination unit determines that the encryption algorithm information is not received. 5. The encrypted communication device according to 1, 2, 3, or 4. After notifying the opposite device of the encryption algorithm information by the algorithm transmission unit, within a predetermined time, has a reception determination unit that determines whether or not the encryption algorithm information has been received from the opposite device,
The data transmission means,
When it is determined by the reception determination means that the encryption algorithm information is received, while transmitting communication data from the communication terminal device to the opposite device in the non-encrypted communication,
The data receiving means,
The communication data from the opposite device is transmitted to the communication terminal device in the non-encrypted communication when it is determined that the encryption algorithm information has been received by the reception determining unit, wherein 5. The encrypted communication device according to 3 or 4. Secret key storage means for storing a common secret key with the opposite device;
Public key generation means for randomly generating a public key;
Public key transmission means for transmitting the public key generated by the public key generation means to the opposite device, and receiving the opposite device side public key from the opposite device,
A common key generation unit that generates a common key based on the opposite device side public key received by the public key transmission unit,
The encrypted communication includes:
Having a first encrypted communication based on the encryption algorithm information and the secret key, and a second encrypted communication based on the common key,
The public key transmission means,
In the first encrypted communication in which the public key generated by the public key generation means is encrypted by the encryption processing means based on the encryption algorithm information and the secret key, the encrypted public key is While transmitting to the opposite device, based on the encryption algorithm information and the secret key, the opposite device side public key received from the opposite device is decrypted by the decryption processing means,
The data transmission means,
In the second encrypted communication in which communication data from the communication terminal device is encrypted by the encryption processing means based on the common key generated by the common key generation means, The encrypted communication device according to claim 5, wherein the encrypted communication device transmits the encrypted communication device to the device. Secret key storage means for storing a common secret key with the opposite device;
Public key generation means for randomly generating a public key;
Public key transmission means for transmitting the public key generated by the public key generation means to the opposite device, and receiving the opposite device side public key from the opposite device,
A common key generation unit that generates a common key based on the opposite device side public key received by the public key transmission unit,
The encrypted communication includes:
Having a first encrypted communication based on the encryption algorithm information and the secret key, and a second encrypted communication based on the common key,
The public key transmission means,
In the first encrypted communication in which the public key generated by the public key generation means is encrypted by the encryption processing means based on the encryption algorithm information and the secret key, the encrypted public key is While transmitting to the opposite device, based on the encryption algorithm information and the secret key, the opposite device side public key received from the opposite device is decrypted by the decryption processing means,
The data transmission means,
In the second encrypted communication in which communication data from the communication terminal device is encrypted by the encryption processing means based on the common key generated by the common key generation means, While transmitting to the device,
The data receiving means,
In the second encrypted communication in which communication data from the opposite device is decrypted by the decryption processing means based on the common key generated by the common key generation means, the decrypted communication data is transmitted to the communication terminal. 7. The encrypted communication device according to claim 6, wherein the encrypted communication device is transmitted to the device.

Images